CAS-005 — questions

A security engineer needs to remediate a SWEET32 vulnerability in an OpenSSH-based application and review existing configurations. Which of the following should the security engineer do? (Choose two.)

A DevOps engineer sets up a CI/CD pipeline to deploy application container images in the Kubernetes production environment. The security engineer wants to prevent the deployment of unsecured images. Which of the following security solutions should the engineer use in the pipeline to meet this objective?

In order to follow new regulations, the Chief Information Security Officer plans to use a defense-in-depth approach for a perimeter network. Which of the following protections would best achieve this goal?

Protected company data was recently exfiltrated. The SOC did not find any indication of a network or outside physical intrusion, and the DLP systems reported no unusual activity. The incident response team determined a text file was encrypted and reviews the following: Which of the following is the most appropriate action for the team to take?

A security team is evaluating the following vulnerabilities in response to a third-party risk assessment: Given the following organizational policy requirements: • Any adjusted CVSS score of 7.0 or greater must be remediated within 15 days. • Any adjusted CVSS score of 6.9 or less must be remediated within 30 days. • Any vulnerability with a known public exploit must be remediated within seven days. • Any vulnerability that requires high privileges can have a lower severity. Which of the following actions should the analyst do to meet the requirements on time?

During an incident response activity, the response team collected some artifacts from a compromised server, but the following information is missing: • Source of the malicious files • Initial attack vector • Lateral movement activities The next step in the playbook is to reconstruct a timeline. Which of the following best supports this effort?

A Chief Information Security Officer is concerned about the operational impact of ransomware. In the event of a ransomware attack, the business requires the integrity of the data to remain intact and an RPO of less than one hour. Which of the following storage strategies best satisfies the business requirements?

A company wants to protect a web-based application against application-layer attacks by monitoring the inputs, outputs, and internal state of the application. The solution must also rapidly integrate with different programming languages. Which of the following technologies is most likely to meet this need?

A security architect performs a baseline review on the SIEM. The findings indicate that multiple use cases are missing and coverage is limited for defense evasion techniques. Which of the following processes best describes what the architect should do?

A vulnerability scan was performed on a website, and the following encryption suites were found: Which of the following actions will remediate the vulnerability?

A developer makes a small change to a resource allocation module on a popular social media website and causes a memory leak. During a peak utilization period, several web servers crash, causing the website to go offline. Which of the following testing techniques is the most efficient way to prevent this from reoccurring?

A company needs to quickly assess whether software deployed across the company's global corporate network contains specific software libraries. Which of the following best enables the company's SOC to respond quickly when such an assessment is required?

A malware analyst must examine the following partial file sample recovered from a Linux workstation: Attempts to run the code in a sandbox produce no results. Which of the following should the malware analyst do next to further analyze the malware and discover useful IoCs?

During a recent security event, access from the non-production environment to the production environment enabled unauthorized users to install unapproved software and make unplanned configuration changes. During an investigation, the following findings are identified: • Several new users were added in bulk by the IAM team. • Additional firewall and routers were recently added to the network • Vulnerability assessments have been disabled for all devices for more than 30 days. • The application allow list has not been modified in more than two weeks. • Logs were unavailable for various types of traffic • Endpoints have not been patched in more than ten days. Which of the following actions would most likely need to be taken to ensure proper monitoring is in place within the organization? (Choose two.)

A security architect is performing threat-modeling activities related to an acquired overseas software company that will be integrated with existing products and systems. Once its software is integrated, the software company will process customer data for the acquiring company. Given the following: Which of the following mitigations would reduce the risk of the most significant threats?

An organization purchased a new manufacturing facility and the security administrator needs to: • Implement security monitoring. • Protect any non-traditional device(s)/network(s). • Ensure no downtime for critical systems. Which of the following strategies best meets these requirements?

Engineers are unable to control pumps at Site A from Site В when the SCADA controller at Site A experiences an outage. A security analyst must provide a secure solution that ensures Site A pumps can be controlled by a SCADA controller at Site В if a similar outage occurs again. Which of the following represents the most cost-effective solution?

As part of a new software development method, a program manager requires that unit tests be written for all code before being promoted to production. The program manager wants to ensure that requirements can be tested and approved. Any security concerns should also be addressed prior to code deployment. Which of the following is an additional benefit of this new requirement?

A security engineer must implement controls to limit access between developer endpoints and a cloud provider bucket for data storage. Developers routinely save sensitive files to the bucket as part of their projects. The security engineer must reduce the risk of unintended data exposure. Which of the following is the most appropriate control to implement?

A systems administrator decides to take a programmatic approach in cataloging system resiliency to both new and existing attack patterns. Which of the following should the systems administrator use?